Commentary
Can You Prove Compliance In The Cloud?
Whether you're in the midst of an audit or a forensic investigation, thorough logs are the key to proving compliance with security regulations. So how do you prove your organization is/was compliant when you aren't able to maintain logs? This is the nagging question that gnaws hungrily at my weary brain every time I ponder cloud computing.Whether you're in the midst of an audit or a forensic investigation, thorough logs are the key to proving compliance with security regulations. So how do you prove your organization is/was compliant when you aren't able to maintain logs? This is the nagging question that gnaws hungrily at my weary brain every time I ponder cloud computing.There are almost as many definitions of "cloud computing" as there are clouds in the sky, but this one, penned by Michael Crandell of RightScale a few months ago, seems to sum it up quite beautifully. Cloud computing is:
- "...the notion of providing easily accessible compute and storage resources on a pay-as-you-go, on-demand basis, from a virtually infinite infrastructure managed by someone else. As a customer, you don't know where the resources are, and for the most part, you don't care. What's really important is the capability to access your application anywhere, move it freely and easily, and inexpensively add resources for instant scalability." --Michael Crandell, RightScale, June 2008. (Thanks to Peter Laird of Oracle for pointing to this definition during his presentation on cloud taxonomy at Interop New York a few weeks ago.)
The parts of this definition that unnerve me are "managed by someone else" and "you don't know where the resources are." I've not yet investigated any of the usage agreements or discussed this with the companies that offer cloud services, but my guess is that organizations have neither the authority nor the ability to establish log settings, maintain logs, or view logs of any activity conducted on that "virtually infinite infrastructure."
More Security Insights
White Papers
- The BlackBerry PlayBook tablet's Good Bones - by BlackBerry
- New Visual and Wizard-Driven Paradigms for Exploring Data and Developing Analytic Workflows
Reports
More >>Webcasts
- Outsourcing Security: What Every Potential Cloud Security Customer Should Know
- Maximize ROI with Database Consolidation onto Private Clouds
This is particularly worrisome if you are (and I really hope you aren't) using cloud computing services for storing sensitive/protected data. Wouldn't you like to know whom else's data is stored on the same server as yours? Wouldn't you like to know when, by whom, and where to your data is copied? Wouldn't you like to know (in the quite likely instance that the cloud data center is employing the use of server virtualization) when the server VM holding your data is migrated to some other server? Wouldn't you like to know that all of these things were done securely? I doubt many organizations are using cloud computing in this way, yet, but it's worth making note of when revamping your risk model for 2009.
There are other little security curiosities gnawing at my brain with cub teeth. For example, it's conceivable to assume that the superior load-balancing capabilities inherent in a cloud server farm make denials of service less likely; but if a denial of service did occur -- whether through an attack or some unintentional outage -- the impact would be quite keenly felt by many organizations.
Mind you, there are some cute, elegant things about cloud services that do make life feel both more fun and more civilized ... I just wouldn't be too hasty moving critical data and services into the cloud.
I'll soon be pestering the major companies offering cloud services -- Google, IBM, and Amazon, for starters -- for answers to these questions. We'll be devoting the entire December issue of the Alert -- our publication for CSI members only -- to the topic of cloud computing and security. Security in the cloud also will be discussed during our Web 2.0 Security summit during our CSI 2008: Security Reconsidered conference in November.
Related Reading
| To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy. | |
|
|
T-Shirt Giveaway: Each week we're selecting one great comment from our readers. The author of the comment will receive an InformaitonWeek Community t-shirt. So get posting! |
Subscribe to RSSResource Links
This Week's Issue
Technology Whitepapers
- Mobile BI: Actionable Intelligence for the Agile Enterprise
- Creating the Enterprise-Class Tablet Environment - by Yankee Group
- How To Regain IT Control In An Increasingly Mobile World - by BlackBerry
- The BlackBerry PlayBook tablet's Good Bones - by BlackBerry
- New Visual and Wizard-Driven Paradigms for Exploring Data and Developing Analytic Workflows
Featured Resource
This is your portal to all the news, product information, technical data, and other information related to the topic of computer user authentication and certification. Visit us to find out how to ensure that computer users are who they say they are.
Learn More












